Overview

overview

8

Static

static

3

2026-07-30...r_.exe

windows10-2004-x64

8

2026-07-30...r_.exe

windows11-ltsc_2024-x64

8

Analysis

  • max time kernel
    149s
  • max time network
    149s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    30/07/2026, 16:45

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-07-30_f35076ce09015c65523785ca31540520_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
  • Size 15.0MB
  • Sample260730-t9qabsdk3t
  • SHA256 acd1a52e3b8f85e217663bdcf2b0d60954220c7c47a3fef6a576c5f2186636f7
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
defense_evasiondiscoverypersistenceransomware

Malware Config

Signatures

  • Drops file in Drivers directory 2 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Sets desktop wallpaper using registry 2 TTPs 2 IoCs
    ransomware
  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies Control Panel 4 IoCs
    defense_evasion
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-07-30_f35076ce09015c65523785ca31540520_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-07-30_f35076ce09015c65523785ca31540520_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe"
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Modifies Control Panel
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:4680
  • C:\Users\Admin\AppData\Local\Temp\2026-07-30_f35076ce09015c65523785ca31540520_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
    C:\Users\Admin\AppData\Local\Temp/2026-07-30_f35076ce09015c65523785ca31540520_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Modifies Control Panel
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:3972

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        Uninstall.exe
        • Path C:\Program Files\7-Zip\Uninstall.exe
        • Size 15.0MB
        • SHA256 199139c5f8930f27e1bd2ef34a8729edbc7bb21b3239787c3963e9b3247aadcc
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        AppVShNotify.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
        • Size 30.3MB
        • SHA256 c13cb0170581d17586ef0a3a2062f19b6c763b10af8df5a331549ff244d6f282
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        InspectorOfficeGadget.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe
        • Size 30.1MB
        • SHA256 a00cf9f7d4a7f8b08c21db12e47f2d98f73736716733ad97202228b774480e7b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        IntegratedOffice.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
        • Size 34.1MB
        • SHA256 4b6982978092656833b73075f48a0cfcb17001409dcd3b5592bf5e01fc38e8d3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        MavInject32.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
        • Size 30.4MB
        • SHA256 8307c4b602e4789a273d3813d29590bffbd857bd31c3e189f73c59e0965f0568
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        OfficeC2RClient.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
        • Size 53.5MB
        • SHA256 3b4d7c00bf9f60ad542162150c777525586f506044f36acf68a2c23fc18d54b5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        VSTOInstaller.exe
        • Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
        • Size 30.1MB
        • SHA256 51f517d46734ea54ea3ef3ecdc605ea03d1435332ffea034802eb495e44ebdd1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        setup.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
        • Size 36.1MB
        • SHA256 625f37c7d1e6f2cbc36ff47bd0dc24e7ffc3c135bf07b1375c3ea1b8c1dace5c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevation_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
        • Size 32.3MB
        • SHA256 86e76e9bffcc11dcbb4a2e43f730a3db10531b66edcfefa04e70fe31c0e0a30f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        notification_helper.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
        • Size 31.7MB
        • SHA256 e2c50511761445b984eb136461c1a2362ad8a9050b0fe4cd16c88d0090379c01
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_proxy.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
        • Size 31.4MB
        • SHA256 dd1375aafd769f9dacdbf1daf89fe93560923a614c362bbc70223d380d6747ec
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        extcheck.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
        • Size 30.1MB
        • SHA256 d47b4e883ff3380401dec449e51a5c6aeb76f736d249a5479bde9e2f5932b918
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        idlj.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
        • Size 30.1MB
        • SHA256 b6dac248a56088db46492ccf0b19123b31358ba1af68db75db4bcb7bebb77a36
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jabswitch.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
        • Size 15.1MB
        • SHA256 9d741f0edd4b4c9744c2e033805661d4ae06698bd5d1af18b9a5f58f3d215d4f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jar.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
        • Size 30.1MB
        • SHA256 8865ac2f1c564aa2c17f22563187511128801fa8963767a6918e52d7b60024d8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jarsigner.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
        • Size 30.1MB
        • SHA256 d761713d741911a5b2d2ff97cacbab50275b23e78e48b703b91d4f35af16caa7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java-rmi.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
        • Size 30.1MB
        • SHA256 b393ac96d453f757c865e02e4e4b506f598f4c5ae5341eb95fff7f309fa87231
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java.exe
        • Size 30.3MB
        • SHA256 fbfb4ab620f55a936d5e5647166535dbce7fdbec8e7f3d51816df75fd3e8ae2a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javac.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
        • Size 30.1MB
        • SHA256 c3cf350276adc38bc8f0fc7ab8d5f14e7738c7dc45ffd00696fce0df362f574e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javadoc.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
        • Size 30.1MB
        • SHA256 a9f2fba86fb0fe1b62d5d7fe3441131a42809bb57eac0a74b76ae595bc07b84b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
        • Size 15.0MB
        • SHA256 3093380a094fb2f4ff1e5ebe4060833e42a7e51101ad2a583a32a3c66b2a1ed6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javapackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
        • Size 30.2MB
        • SHA256 72bd979939282fb85bf215099e91772a3caa05a1b4873085df0660debf5b5c4f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaw.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
        • Size 30.3MB
        • SHA256 97f8285ef9e7d3b5ecd064d40258d8b77ff8210a14826aa6fb81337af6329022
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaws.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
        • Size 30.5MB
        • SHA256 0355a102486ad19c7ff5bc51d237725dd9c35c28205481e902df5f5d208896b9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jconsole.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
        • Size 256KB
        • SHA256 6adff2403606f3fae51ba272308ce91c8124c63f116c3d886a5a38b4ccbce497
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdb.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
        • Size 30.1MB
        • SHA256 50d91173915c669d360ae2cc0635ae19956f30a689894ae70f1ef0a172412fe7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdeps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
        • Size 30.1MB
        • SHA256 098ea43142c4f68aba1c0216ac33b5fa95ea8fe17d707cde8408359d798a9e0b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jhat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
        • Size 448KB
        • SHA256 ef1671569d85236e5e1438807fc26fa3d0c89d95284243558028b54dd4ac3913
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jinfo.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
        • Size 30.1MB
        • SHA256 965280150ca36ef90d76ca623b9a30a4f6c72ddccf1c4f6dbf4e2f9161150a40
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jjs.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
        • Size 30.1MB
        • SHA256 26d159e8f58609128afc110da7d26f41cfd1d9aaacaa90e0e88e38f2391e341f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jrunscript.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
        • Size 30.1MB
        • SHA256 9e2f18cfbcf085ed496a8a6413f42ee5856f2709e7e3a287d920ed9690efe7e2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jsadebugd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
        • Size 30.1MB
        • SHA256 91209b80f00d7042114287c87dad036c36b5b37cb4e2309cd2afd67f733aefe3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstack.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
        • Size 30.1MB
        • SHA256 6010cd318900bf257f4b3d57518518811a767521d65d824aae8dde86788dee3f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
        • Size 30.1MB
        • SHA256 3356ccecd4b41e778a1f469f94747df3fbcdc78c4ecd20b77d7f1b7f461c3e7c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstatd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
        • Size 30.1MB
        • SHA256 9a88ec0ea68a0633022f2098385ef78780d98e56e27078dfbfeb63001d495d01
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        keytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
        • Size 30.1MB
        • SHA256 a70d7fbfa84bdba210044351ba77cd0157b8a5dd7c60320bd188b1373b63d232
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        kinit.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
        • Size 30.1MB
        • SHA256 57729747dc45f6f3fa9158cd67b303d1e7fda4e1f76f47d4dc75d89e48856f2a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        klist.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
        • Size 30.1MB
        • SHA256 4f181b4e4bc96b734c5a4574545875300100319f4e4626936e9abd01c0f739ef
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ktab.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
        • Size 30.1MB
        • SHA256 41de28c313013934328400b82324f30baf8f1d67029f29af9d9485d474ad094e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        native2ascii.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
        • Size 30.1MB
        • SHA256 0b8589c12842b9b7c1116e66bcdb7300ebb602be93a9a4875e225aab002dd648
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        orbd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
        • Size 30.1MB
        • SHA256 f6ab7e881a9ae4fc1abab9950e7d12c468bfa5719af175802816c1f47b120489
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        pack200.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
        • Size 30.1MB
        • SHA256 d7722b6b0edc63ba1b8a6b3446b739e8cb1cd6188855ffc4b949cae0728cfa46
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        policytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
        • Size 30.1MB
        • SHA256 488d82fd4064513c330a6ba82334694a51c4161a8701083544a3ce268611d21f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmic.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
        • Size 30.1MB
        • SHA256 35559a45ad02ec07cdf31b844ec34bda687d671b516d98433b64872360eb4867
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmid.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
        • Size 30.1MB
        • SHA256 5fd8b9691769c0fe6f37a4f96a3018a67da2dc48c722b54ae2d0b83e7f90625f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmiregistry.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
        • Size 30.1MB
        • SHA256 a0a1d96f82d0d331506ccb8d6f1e3015105e3659cd293aa1730e6802cf550415
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        schemagen.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
        • Size 30.1MB
        • SHA256 85283320c8912af7dbe9a516866c6824ce62b2a80667dfb40f626eaa3fe4095f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        serialver.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
        • Size 30.1MB
        • SHA256 68554e8c1da32086e21b7e2453ca513963ee608697ad2033861036b12c2299f8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        servertool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
        • Size 30.1MB
        • SHA256 b1b087ad58c1989c66f22bc088b2a03742fe3fee4101dd85cada552a2afbd523
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe
        • Size 30.1MB
        • SHA256 2da7516b59a80b6cdd1464ded3c575c0c7ba89a9ba07f93583bbe5082e252230
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe
        • Size 30.1MB
        • SHA256 82c41534dc9556494082646451245b1480fb5331446714f9c2f1dbfb967c0438
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe
        • Size 30.1MB
        • SHA256 ffce3fc874e46d4ef9e65965259c6eebcd3ea0c0e55434b0221e0645d134e92d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download